Suspected Kazakhstan-linked hackers target governments across former Soviet states

A cyber-espionage group with suspected ties to Kazakhstan has targeted government agencies across Central Asia and other former Soviet states, seeking information on diplomatic affairs, economic policy and strategic resources, according to new research.

The hackers, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future's Insikt Group, have conducted at least eight campaigns since January 2025, the two teams said in jointly issued reports. The Record is an editorially independent unit of Recorded Future.

The campaign targeted or showed interest in government institutions across nine countries, including Russia, Belarus, Armenia, Uzbekistan and Tajikistan, the researchers said.

Researchers said the hackers appeared particularly interested in government agencies responsible for foreign affairs, economic development, agriculture and environmental management, as well as information about regional energy supplies and water resources.

“These organizations hold information that can inform negotiations, economic planning, and regional security decisions,” the Insikt Group said. “Across Central Asia, shared river systems and interconnected energy and transport infrastructure give such information particular strategic value.”

Local clues

Researchers assessed with medium confidence that the hacking group has ties to Kazakhstan.

The clues include Russian-language material found in the malware, evidence suggesting that malicious software was tested from Kazakhstan shortly after it was created, and hacking activity that generally matched working hours in the country's time zone.

The group's operations also overlap with earlier cyber-espionage campaigns linked to YoroTrooper, a suspected Kazakhstan-based threat actor that emerged in 2022 and has primarily targeted governments in Central Asia and neighboring countries.

In one of its latest attacks, TAG-193 hackers targeted a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026. Another operation targeted a Belarusian government entity ahead of a bilateral meeting in April.

Researchers said the timing could indicate an interest in diplomatic developments, although it does not establish what information the hackers were seeking or whether they obtained it.

The group also showed interest in environmental and natural resource management, including an Armenian government agency responsible for environmental affairs and Uzbekistan's Smart Forestry initiative.

Hacking techniques

The group typically attempts to compromise its targets through phishing emails containing malicious attachments, sometimes sent from legitimate government email accounts that have already been compromised.

The emails use official-looking documents, including diplomatic correspondence, aviation forms and business proposals.

Researchers said the hackers also used GitHub, the software development platform, to store malicious scripts and files, helping their operations blend in with legitimate online activity.

In April 2026, the group was observed exploiting a security vulnerability in the file compression program WinRAR in an operation likely targeting Armenia's Ministry of Foreign Affairs.

The flaw, tracked as CVE-2025-8088, allowed the attackers to place malware in a Windows folder that automatically runs programs when a user signs in.

Researchers said it was the first time they had observed the group exploiting a software vulnerability to deliver malware, suggesting it was expanding its methods beyond deceptive emails and documents.

Researchers expect the group to continue targeting diplomatic institutions and government agencies responsible for managing strategic resources across the region.

“Its sustained operations and adoption of additional delivery techniques suggest continued investment in gaining access to institutions holding information of strategic interest,” they added.